IT Audit Course

Lesson 1 • The IT Audit Lifecycle

Outlines the end-to-end audit process from planning through reporting. Students understand how each phase connects to produce audit conclusions.

Lesson 2 • IT Audit Purpose and Scope

Defines IT auditing and distinguishes it from financial and operational auditing. Anchors the chapter by establishing why IT controls matter to organisations.

Lesson 3 • IT Governance and Control Frameworks

Introduces major control frameworks used to structure IT audits. Students map framework domains to real audit objectives.

Lesson 4 • Risk Concepts in IT Auditing

Covers inherent, control, and detection risk as applied to IT environments. Provides the risk vocabulary used throughout the course.

Lesson 1 • Developing the Audit Plan

Translates the risk register into a formal audit plan with scope, objectives, and resource allocation. Ensures audit effort targets highest-risk areas.

Lesson 2 • Risk Scoring and Prioritisation

Applies qualitative and quantitative scoring models to rank identified risks. Produces the prioritised risk register used in audit planning.

Lesson 3 • Understanding the IT Environment

Techniques for documenting infrastructure, applications, and data flows before fieldwork begins. Accurate environment mapping drives risk identification.

Lesson 4 • Stakeholder Communication in Planning

Covers engagement letters, kickoff meetings, and expectation alignment with auditees. Effective communication prevents scope disputes during fieldwork.

Lesson 1 • Backup and Recovery Controls

Assesses backup frequency, integrity testing, and recovery time objectives. Validates that data can be restored within business-acceptable timeframes.

Lesson 2 • Access Management Controls

Examines user provisioning, authentication, and privileged access controls. Access weaknesses are amongst the most common IT audit findings.

Lesson 3 • IT Operations and Job Scheduling

Reviews batch processing, job scheduling, and incident management controls. Operational failures can cascade into financial and data integrity issues.

Lesson 4 • Physical and Environmental Controls

Audits data centre physical security, environmental monitoring, and power redundancy. Physical control failures can negate all logical security measures.

Lesson 1 • Output Controls and Distribution

Ensures reports and data outputs are accurate, authorised, and delivered to intended recipients. Output weaknesses can expose sensitive data or mislead decisions.

Lesson 2 • Processing Controls and Integrity

Verifies that application logic processes transactions accurately and completely. Covers reconciliation controls and exception reporting mechanisms.

Lesson 3 • Application Audit Evidence Techniques

Applies data extraction, sampling, and walkthrough methods specific to application audits. Connects evidence-gathering techniques to application control objectives.

Lesson 4 • Input Controls and Validation

Tests controls that prevent erroneous or unauthorised data from entering systems. Input control failures propagate errors throughout downstream processes.

Lesson 1 • Endpoint and Patch Management

Evaluates endpoint protection, patch currency, and configuration hardening. Unpatched endpoints represent the most exploited vulnerability class.

Lesson 2 • Vulnerability and Penetration Testing Review

Evaluates the organisation's vulnerability scanning programme and penetration test results. Auditors assess remediation effectiveness rather than conduct testing themselves.

Lesson 3 • Security Monitoring and Logging

Assesses log collection, retention, and security event monitoring capabilities. Effective monitoring is essential for detecting and responding to incidents.

Lesson 4 • Identity and Access Security

Audits multi-factor authentication, identity lifecycle, and privileged identity management. Identity is the primary control plane in modern environments.

Lesson 1 • Privacy Controls and Consent Management

Audits personal data collection, consent mechanisms, and subject rights fulfilment. Privacy controls must align with applicable data protection principles.

Lesson 2 • Data Governance and Classification

Reviews data ownership, classification schemes, and governance structures. Proper classification drives appropriate protection and handling controls.

Lesson 3 • Data Quality Controls

Tests accuracy, completeness, consistency, and timeliness of organisational data. Data quality failures undermine business decisions and regulatory reporting.

Lesson 4 • Data Retention and Disposal

Evaluates retention schedules, secure disposal methods, and legal hold processes. Improper retention or disposal creates regulatory and reputational risk.

Lesson 1 • Sampling Methodologies

Applies statistical and non-statistical sampling to IT control populations. Sampling decisions affect the conclusions that can be drawn from test results.

Lesson 2 • Documenting Control Deficiencies

Structures findings using condition, criteria, cause, and effect components. Precise deficiency documentation enables management to understand and remediate issues.

Lesson 3 • Workpaper Standards and Structure

Applies professional workpaper standards including indexing, cross-referencing, and sign-off. Well-structured workpapers support supervisory review and future audits.

Lesson 4 • Workpaper Review and Quality Assurance

Covers peer review, supervisory sign-off, and quality assurance processes for workpapers. Quality review catches documentation gaps before the report is issued.

Lesson 1 • Remediation Tracking and Follow-Up

Establishes processes for tracking management action plans and verifying remediation closure. Follow-up ensures audit findings translate into lasting control improvements.

Lesson 2 • Audit Report Structure and Components

Defines standard report sections including scope, findings, and recommendations. A well-structured report communicates audit results to both technical and executive audiences.

Lesson 3 • Presenting Results to Stakeholders

Covers closing meeting facilitation, executive presentations, and handling auditee disagreements. Effective presentation skills determine whether findings lead to real change.

Lesson 4 • Writing Effective Audit Findings

Applies plain-language writing techniques to translate technical issues into business impact. Findings must be understood by non-technical stakeholders to drive action.